CVSS: 6.8EPSS: 0%CPEs: 137EXPL: 4CVE-2011-2191
https://notcve.org/view.php?id=CVE-2011-2191
Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee before 1.2.99 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, as demonstrated by a crafted nickname field to vserver/apply. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Cherokee-admin de Cherokee en versiones anteriores a la 1.2.99. Permite a atacantes remotos secuestrar la autenticación de administradores en peticiones que insertan secuencias de comandos en sitios cruzados (XSS), como se ha demostrado por un campo de nombre de usuario ("nickname") a vserver/apply. • http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066222.html http://osvdb.org/72693 http://seclists.org/fulldisclosure/2011/Jun/0 http://www.cherokee-project.com/download/LATEST_is_1.2.99/cherokee-1.2.99.tar.gz http://www.openwall.com/lists/oss-security/2011/06/02/2 http://www.openwall.com/lists/oss-security/2011/06/03/6 http://www.openwall.com/lists/oss-security/2011/06/06/22 http://www.securityfocus.com/bid/49772 https://bugzilla • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 2.1EPSS: 0%CPEs: 137EXPL: 0CVE-2011-2190
https://notcve.org/view.php?id=CVE-2011-2190
The generate_admin_password function in Cherokee before 1.2.99 uses time and PID values for seeding of a random number generator, which makes it easier for local users to determine admin passwords via a brute-force attack. La función generate_admin_password de Cherokee en versiones anteriores a la 1.2.99 utiliza la fecha y el PID para crear la semilla del generador de números aleatorios, lo que facilita a usuarios locales determinar la contraseña de admin a través de ataque de fuerza bruta. • http://code.google.com/p/cherokee/issues/detail?id=1212 http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066222.html http://www.cherokee-project.com/download/LATEST_is_1.2.99/cherokee-1.2.99.tar.gz http://www.openwall.com/lists/oss-security/2011/06/03/4 http://www.openwall.com/lists/oss-security/2011/06/06/21 http://www.securityfocus.com/bid/49772 https://bugzilla.redhat.com/show_bug.cgi?id=713304 • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 3CVE-2009-4489 – Cherokee 0.99.30 - Terminal Escape Sequence in Logs Command Injection
https://notcve.org/view.php?id=CVE-2009-4489
header.c in Cherokee before 0.99.32 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator. header.c en Cherokee anterior a v0.99.32, escribe datos en un archivo de los sin depurar los caracteres no escribibles, lo que podría permitir a atacantes remotos modificar la ventana de título, o posiblemente ejecutar comandos de su elección o sobrescribir archivos, a través de una petición HTTP que contiene una secuencia de escape para el emulador de terminal. Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa are subject to log escape sequence injection vulnerabilities. • https://www.exploit-db.com/exploits/33501 http://secunia.com/advisories/37933 http://svn.cherokee-project.com/changeset/3944 http://svn.cherokee-project.com/changeset/3977 http://www.securityfocus.com/archive/1/508830/100/0/threaded http://www.securityfocus.com/bid/37715 http://www.ush.it/team/ush/hack_httpd_escape/adv.txt http://www.vupen.com/english/advisories/2010/0090 • CWE-20: Improper Input Validation •